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Abstract 

This  primer  describes  a  notation  for  program  composition.  Program  composi¬ 
tion  is  putting  programs  together  to  get  larger  ones.  PCN  (Program  Compo¬ 
sition  Notation)  is  a  programming  language  that  allows  programmers  to  com¬ 
pose  programs  so  that  composed  programs  execute  efficiently  on  uniprocessors, 
distributed- memory  multicomputers  or  shared- memory  multiprocessors. 

The  programs  that  are  put  together  using  PCN  can  be  in  PCN  itself  or 
in  C  or  in  Fortran.  Later  implementations  of  PCN  will  allow  composition  of 
programs  in  notations  in  addition  to  C  and  Fortran. 

PCN  is  implemented  on  a  variety  of  sequential  and  concurrent  architec¬ 
tures  including  networks  of  UNIX-based  workstations  (Sun  and  NeXT),  Sy- 
mult  2010,  Intel  iPSC,  BBN  Butterfly,  and  Sequent  Symmetry. 

Several  programming  examples  are  presented  in  the  primer.  The  exam¬ 
ples  are  presented  with  methods  for  reasoning  about  the  correctness  of  PCN 
programs. 


’Supported  by  NSF  under  Cooperative  Agreement  CCR-8809615,  and  AFOSR  and 
ONR  under  Grant  N00014-89-J-3201.  The  government  has  certain  rights  in  this  material. 


1  Overview 


PCN  is  based  on  UNITY  [3],  a  theory  and  a  notation  for  concurrent  program¬ 
ming,  and  on  Strand[6].  Composition  in  PCN  is  motivated  by,  but  is  different 
from,  composition  in  CSP  [8]  The  motivation  for  PCN  and  a  comparison  of 
PCN  with  other  notations  is  found  in  [4].  A  programming  environment  and 
the  run-time  support  system  for  PCN  are  described  in  [2]  and  [7],  respectively. 

1.1  New  Concepts 

PCN  has  a  three  concepts  that  are  not  in  languages  such  as  C  or  Fortran. 
Next,  these  concepts  are  discussed  very  briefly  and  informally.  Readers  may 
want  to  skim  through  sections  describing  familiar  material  so  as  to  spend  more 
time  on  the  new  concepts. 

1.  Mutables  and  Definition  Variables:  PCN  has  two  kinds  of  vari¬ 
ables:  mutables  and  definition  variables.  Mutables  are  variables  as  in  C. 
Definition  variables  are  different  from  variables  in  C;  values  of  definition 
variables  can  be  algebraic  formulae  (such  as  y  +  z),  the  initial  value  of 
a  definition  variable  is  a  special  symbol  indicating  that  it  is  undefined, 
and  a  definition  variable  is  defined  at  most  once.  For  most  programmers, 
the  concept  of  mutable  variables  is  familiar  and  the  concept  of  definition 
variables  is  new. 


PfM 


2.  Composition  Oneratncse  4, 


•  put  blocks  together  using  composition  operators, 

•  define  elementary  blocks. 


,  or 


PCN  has  three  composition  operators:  sequential  composition,  choice 
composition  and  parallel  composition. 

Sequential  composition  of  a  list  of  blocks  executes  the  blocks  in  sequence, 
just  as  in  C  or  Fortran.  Choice  composition  is  an  extension  of  if-then- 
else  and  guarded  commands.  In  a  parallel  composition  of  a  list  of  blocks, 
all  blocks  in  the  list  are  executed  in  parallel,  and  the  parallel  composition 
completes  execution  when  all  its  constituent  blocks  complete  execution. 
For  most  programmers,  sequential  and  choice  composition  are  familiar 
concepts,  while  parallel  composition  is  new. 

The  central  concept  of  PCN  is  that  of  composition  —  putting  blocks 
together  and  once  that  is  mastered  all  forms  of  composition  are  equally 
easy. 

3.  Tuples:  PCN  has  a  data  type  called  a  tuple  which  is  a  sequence  of 
items  between  braces  ‘{’  and  ‘}\  Linear  lists,  circular  lists,  trees  and 
other  such  linked  structures  are  constructed  using  tuples. 

The  concepts  of  mutables,  definition  variables  and  composition  are  different 
from  concepts  found  in  conventional  notations,  and  therefore,  readers  should 
focus  attention  on  these  ideas. 


1.2  Highlighting  Examples,  Syntax  and  Operation 

Most  of  this  primer  consists  of  examples;  a  large  number  are  found  in  the  Sim¬ 
ple  Programming  Examples  section.  There  are  times  when  readers  will  want 
to  study  examples  carefully  and  there  are  other  times  when  readers  will  want 
to  skip  examples.  To  help  identify  examples,  an  example  is  placed  between 
lines  as  in: 


3 


Examples  of  tuples 
The  empty  tuple:  {}. 


Most  examples  are  on  odd-numbered  pages,  and  are  therefore  on  right-hand 
side  pages  with  most  text  on  left-hand  side  pages. 

For  ease  in  indentification,  syntax  is  placed  between  lines  as  in: 


tuple  ::  {-^  term  >-} 


The  operation  of  statements  in  PCN  are  described  in  terms  of  operations 
in  familiar  languages  such  as  C.  Operational  descriptions  of  PCN  statements 
are  placed  between  lines  as  in: 


repeat  skip  until  rhs  is  reducible; 
assign  the  reduced  value  of  rhs  to  m. 
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2  Syntax 

In  this  document  we  use  a  stylized  syntax  to  convey  the  central  concepts;  a 
complete  formal  BNF  is  given  in  Appendix  A.  All  nonterminal  symbols  are 
in  italics,  and  all  terminal  symbols  are  in  plain  type.  The  notation  -<  su  y, 
where  su  is  a  syntactic  unit,  represents  a  list  of  zero  or  more  instances  of  the 
syntactic  unit,  with  multiple  instances  separated  by  commas.  The  notation 
^  su  is  a  list  of  one  or  more  instances  of  su  separated  by  commas  The 
notation  (su)  denotes  an  optional  syntactic  unit  su. 

Variable  names,  comparison  operators,  macros,  and  file  inclusion  are  as  in 
C.  A  comment  begins  with  /*  and  ends  with  */  as  in  C.  Expressions  in  PCN 
have  the  same  syntax  as  arithmetic  expressions  in  C,  except  that  the  only 
operators  in  PCN  are  %,  +,  -,  *  and  /. 

A  variable  name  is  a  sequence  of  characters  where  the  first  character  is  a 
letter,  and  a  character  is  a  letter  or  a  digit.  A  letter  is  an  upper  case  or  lower 
case  letter  of  the  alphabet,  or  it  is  the  symbol  An  upper  case  letter  is 
different  from  a  lower  case  letter. 
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3  Data  Types 

3.1  Conventional  Data  Types 

Conventional  data  types,  such  as  in  C,  are  also  data  types  in  PCN: 

1.  char  for  character, 

2.  int  for  integer, 

3.  double  for  double-precision  floating  point  number. 

PCN  has  one-dimentional  arrays  of  these  data  types.  Arrays  in  PCN 
and  C  are  treated  in  the  same  way  and  are  indexed  from  zero. 

Strings  in  PCN  are  treated  in  exactly  the  same  way  as  in  C.  A  string  S 
is  an  array  A  of  char,  where  the  characters  of  S  are  A[i],  in  increasing  order 
of  i  starting  with  i  =  0  and  ending  with  i  =  k,  where  k  is  the  smallest  index 
such  that  A\k  +  1]  is  the  null  character  \0.  If  A[0]  is  the  null  character,  S  is 
the  empty  string.  A  constant  string  can  be  denoted  by  placing  the  characters 
of  the  string  between  quotes;  for  example  "PCN"  is  a  string  consisting  of  the 
three  characters:  P,  C  and  N.  The  empty  string  is  "  ", 

In  this  document,  a  number  is  an  integer  or  a  double-precision  floating 
point  value.  We  define  a  simple- value  as  a  number  or  a  character  or  an  array 
of  numbers  or__a 

Qualifiers  for  int  in  C  (such  as  short,  long,  and  unsigned)  are  not  available 
in  PCN,  nor  are  single-precision  floating  point  numbers  and  structures. 


3.2  Tuples  and  Lists 

A  tuple  is  a  pointer  to  a  possibly  empty  sequence  of  terms,  where  a  term  is  a 
simple- value,  an  expression,  or  a  tuple.  A  tuple  is  represented  in  a  program  as 
a  sequence  of  terms  between  braces  —  ‘{’  and  —  where  terms  are  separated 
by  commas. 

A  list  is  a  special  case  of  tuple.  A  list  is: 

1.  The  empty  tuple,  {},  or 
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Examples  of  tuples 
The  empty  tuple:  {}. 

A  1-tuple:  {{a:}},  where  the  single  element  of  the  tuple  is  itself 
a  1-tuple,  {x}. 

A  2-tuple:  {"ra.sg",3}. 


Examples  of  lists 


The  empty  list:  {} 

A  single-element  list:  {d,  {}}  is  a  list  containing  a  single 
element,  d. 

A  four-element  list:  {a,  {6,  {c,  {d,  {}}}}}  is  a  list  contain¬ 
ing  the  sequence  of  4  elements,  a,  b,  c  and  d,  in  that  order. 
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2.  A  2-tuple,  {«,&},  where  the  second  element  of  the  tuple,  b,  is  a  list. 

PCN  has  a  more  succinct  notation  for  lists:  a  list  consisting  of  a  sequence  of 
zero  or  more  elements  can  be  represented  by  the  sequence  of  elements  between 
the  enclosing  brackets‘[’  and  ‘]\  Also,  for  brevity,  we  can  employ  the  notation, 
[L1,L2,...,Lk  |  z],  to  represent  the  tuple,  { L u  {X2,  {...{£*,2}...}}}. 

For  convenience,  the  notation  h(x 0, . . .  ,xk),  where  h  is  an  identifier  and 
x0,...,xk  are  tuple-elements,  denotes  the  tuple  {"/&",  x0, . . . ,  xk};  this  allows 
programs  to  be  represented  as  data. 

Syntax  of  Tuples  A  tuple  has  the  following  syntax: 


tuple  ::  {x  term  >-}  | 

[A  term  >-]  | 

1  J  ^  til — ii '  1  ' -  . V-- 


Examples  of  list  notation 

The  empty  list:  The  empty  list  is  [  ];  hence  []  =  {}. 

A  single-element  list:  [d]  is  a  list  containing  a  single  ele¬ 
ment,  d;  hence  [d]  =  {of,  {}}. 

A  four-element  list:  [a,  6,  c,  d]  is  a  list  containing  the  se¬ 
quence  of  4  elements,  a ,  b,  c  and  d,  in  that  order;  hence 
[a,b,c,d\  =  {a,  {6,  {c,  {o?,  {}}}}}. 

Catenation  of  lists:  A  list,  y,  consisting  of  a  sequence  of 
values,  w,  v,  10,  followed  by  another  list,  z,  is  represented  by: 
[u,v,w  I  z]\  thus,  if  z  -  [b,c,d],  and  y  =  [u,v,w  \  z],  then 
y  =  [u,v,w,b,c,d\. 


More  examples  of  tuples 
g(x )  and  {"g",x}  denote  the  same  tuple. 
f(x,y)  and  {"f",x,y}  denote  the  same  tuple. 
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The  length  Function  PCN  includes  a  function  length  which  has  a  single 
argument  and  returns: 

•  the  number  of  elements  in  the  argument  if  its  argument  is  a  tuple  or  an 
array,  and 

•  1  (one)  if  its  argument  is  a  single  number  or  character. 

The  argument  of  length  must  be  a  variable.  Note  the  difference  between 
the  length  function  in  PCN  and  the  sizeof  function  in  C:  in  C  the  function 
returns  the  size  of  its  argument  in  bytes,  whereas  in  PCN  the  function  returns 
the  number  of  elements. 

Elements  of  a  tuple  are  referenced  in  the  same  way  as  elements  of  an  array 
in  C:  t[i\  is  element  i  of  a  tuple  t,  for  0  <  i  <  length(t). 
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Examples  of  length  function 
Arrays  of  numbers: 

/*  declare  u  to  be  an  array  of  10  doubles  */ 
double  w[10]; 
length(u)  is  10. 

A  single  number: 

/*  declare  i  to  be  an  integer  */ 
int  i; 

length(i )  is  1. 

A  tuple:  Let  z  be  the  tuple  {x,y}]  then  length(z)  is  2. 
A  string: 

/*  declare  D  to  be  an  array  of  10  chars  */ 
char  I?  [10]; 
length(D)  is  10. 
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4  Variables 

4.1  Values  of  Variables 

At  each  point  in  a  computation,  a  variable  has  precisely  one  value.  The  value 
of  a  variable  is  a  term.  The  value  of  a  variable  in  PCN  can  be  an  expression 
such  as  y  z.  In  C,  execution  of  the  assignment  x  —  y  -T  z  causes  the  value  of 
x  to  become  the  value  of  y  plus  the  value  of  z,  and  thus  the  values  of  variables 
x,  y  and  z  in  C  are  always  numbers;  the  execution  of  the  assignment  in  C  does 
not  make  the  value  of  x  become  the  formula  y  +  z.  Indeed,  in  most  notations, 
values  of  variables  are  numbers  or  characters,  but  not  expressions.  Variables 
in  PCN  can  have  expressions  as  values  which  allows  for  a  degree  of  symbolic 
computation  in  addition  to  the  usual  numeric  computation  of  C  and  Fortran. 


Notation  for  Valnp  of  a  Variahle.  Tn  -  at  —  D  rLr>ruri4-on  ■* 


Examples  of  Values  of  Variables 
Possible  values  of  a  variable  x  are  presented  next. 
Simple-Value:  value(x)  is  2. 

Expression  as  Value:  value(x)  is  y  +  z. 
Expression  as  Value:  value(x)  is  u  +  v  *  (y  +  z). 
Tuple  as  Value:  value(x)  is  {?/}. 

Tuple  as  Value:  value (x)  is  {2 ,"A",y,z}. 


13 


4.2  Mutables 


The  type  of  a  mutable  is  declared  in  programs  in  which  it  is  used,  its  initial 
value  is  an  arbitrary  value  of  its  declared  type,  and  its  value  can  be  changed 
arbitrarily  often  during  a  computation  by  execution  of  assignment  statements 
that  assign  values  to  it.  Type  declarations  are  as  in  C.  A  mutable  type  is  a  C 
type  (i.e.,  char,  int,  or  double). 


4.3  Definition  Variables 

A  definition  variable  is  different  from  variables  used  in  C.  A  definition  vari¬ 
able  is  either  undefined  or  defined;  it  can  be  defined  at  most  once  in  a 
computation.  A  definition  variable  is  defined  to  be  a  term  by  executing  a  def¬ 
inition  statement  in  which  the  definition  variable  appears  on  the  left-hand 
side;  definition  statements  are  described  later. 

The  value  of  an  undefined  definition  variable  is  undefined.  The  value  of  a 
defined  definition  variable  is  its  definition.  The  value  of  a  definition  variable 
does  not  reference  mutables. 

Definition  variables  are  not  declared. 

4.4  Review  of  Differences  between  Definition  Variables 
and  Mutables 

Declaration  Mutables  are  declared.  Definition  variables  are  not  declared. 

Initial  Value  The  initial  value  of  a  mutable  is  an  arbitrary  value  of  its 
declared  type.  The  initial  value  of  a  definition  variable  is  a  special  symbol 
indicating  that  it  is  undefined. 

Expressions  as  Values  The  value  of  a  mutable  cannot  be  an  expression. 
The  value  of  a  definition  variable  can  be  an  expression. 


Tuples  as  Values  The  elements  of  a  tuple  are  initially  definitions  variables 
and  can  be  defined  using  definition  statements.  The  value  of  a  definition 
variable  can  be  a  tuple;  however,  no  element  of  a  tuple  can  be  a  mutable. 
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Changes  in  Values  The  value  of  a  mutable  can  be  changed  arbitrarily  many 
times.  The  value  of  a  definition  variable  can  be  changed  at  most  once,  from 
undefined  to  a  defined  value.  Once  a  definition  variable  is  defined,  its  value 
remains  unchanged  forever  thereafter. 
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5  Programs 

A  program  consists  of  a  heading  followed  by  a  declaration  section  followed  by 
a  block.  The  heading  is  the  program  name  and  a  list  of  formal  parameters, 
as  in  C.  In  PCN  all  parameters  are  passed  by  reference,  unlike  in  in  C  where 
parameters  can  be  passed  by  value.  The  syntax  of  a  declaration  section  is 
identical  to  that  in  C.  The  scope  of  a  variable  is  the  program  in  which  it 
appears:  all  variables  that  appear  in  a  program  are  either  formal  parameters 
or  local  variables  of  the  program.  All  mutables  referenced  in  a  program  are 
declared  in  the  declaration  section  of  the  program;  definition  variables  are  not 
declared. 

Local  variables  in  PCN  are  local  to  the  program  in  which  they  are  de¬ 
clared,  whereas  local  variables  in  C  can  be  declared  to  be  local  to  blocks 
within  programs.  Also,  C  allows  programs  to  access  variables  that  are  not 
formal  parameters  or  local  variables  of  the  program,  whereas  PCN  does  not. 

The  dimensions  of  a  local  array  of  a  program  can  change  from  one  call 
of  the  program  to  the  next,  unlike  in  C  where  some  of  the  dimensions  of  a 
multidimensional  local  array  must  remain  unchanged  in  all  calls. 

The  syntax  of  a  block  is: 


block 


elementary-block  |  composed-block 


elementary-block  ::  definition-statement  | 

assignment-statement 

program-call 


Composed  blocks  are  discussed  later;  the  next  few  sections  discuss  each  of 
the  forms  of  elementary  blocks. 
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An  Example  of  Formal  Parameters  and  Local  Variables 

p(sum ,  x ) 
int  sum,  v; 

{?  x  ?=  [m  |  xs]  — > 

{;  v  :=  m,  sum  sum  +  v ,  p(sum,xs )} 

The  operators  in  this  example  are  not  important  here;  only  the 
heading  and  the  declarations  are  relevant.  The  first  line  is  the 
heading  for  a  program  with  name,  p,  and  two  formal  parameters, 
sum  and  x.  The  second  line  declares  sum  and  v  to  be  integer. 
Therefore,  sum  and  v  are  mutable.  Since  the  types  of  x,  xs 
and  m  are  not  declared,  they  are  definition  variables.  Since  xs, 
m  and  v  are  not  formal  parameters,  they  are  local  variables  of 
program  p. 
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6  Definition  statements 

A  definition  statement  has  the  following  syntax: 


definition-statement  ::  definition-variable  =  term 


The  execution  of  the  definition  statement  x  =  rhs  completes,  and  at  com¬ 
pletion,  value(x)  is  rhs'  where  rhs '  is  obtained  by  substituting  value{v)  for 
each  mutable  v  in  rhs.  Mutables  do  not  appear  in  rhs' ,  and  hence  the  value 
of  a  definition  variable  does  not  name  mutables. 

The  value  of  an  expression  in  PCN  can  be  an  array.  For  example  if  mutable 
m  is  declared  to  be  an  array  of  integers,  then  the  value  of  the  expression  ‘m’ 
is  an  array.  Hence,  upon  completion  of  the  execution  of  the  statement  x  =  m, 
the  value  of  x  is  an  array. 

Arithmetic  operators  in  PCN  are  identical  to  those  in  C,  and  hence  their 
operands  are  numbers,  not  arrays  of  numbers.  So  the  expression  ‘m+1’,  where 
m  is  an  array,  is  incorrect. 
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Examples  of  Definition  Statements  Without  Mutables 
In  these  examples,  z  is  a  definition  variable. 

number:  Execution  of  the  definition  statement 

z  =  3.0 

terminates  with 

value(z)  =  3.0. 

string:  Execution  of  the  definition  statement, 
z  =  "abc  " 
terminates  with 

value(z)  =  "abc". 
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Examples  of  Definition  Statements  With  Mutables 

In  these  examples,  z  and  y  are  definition  variables,  and  m  is  a 
mutable  with  value  2  at  the  point  in  the  computation  at  which 
the  definition  statements  are  executed. 

expression:  Execution  of  the  definition  statement 
z  =  y  +  m  +  5 
terminates  with 

value(z)  =  y  - f  2  +  5. 

tuple:  Execution  of  the  definition  statement 
*  =  {y,{m},5} 
terminates  with 

value(z)  =  {y,{  2},  5}. 

tuple:  Execution  of  the  definition  statement 
z  = 

terminates  with 

value(z)  =  [2,  "6"]. 
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Examples  of  Definition  Statements  With  Arrays 

If  A  is  a  2-element  integer  array  with  A[0]  =  1,  and  A[l]  =  2, 
then  the  definition  statement,  z  =  A  terminates  with  2  de¬ 
fined  as  a  2-element  integer  array  with  value(z[Q])  =  1,  and 
value(z[l ])  =  2. 
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T  Reducibility 

The  meaning  of  an  assignment  is  based  on  the  concept  of  reducibility.  For  a 
term  e,  the  reduced  value  of  e  is  a  simple-value  or  tuple  x,  where  x  =  e.  A 
term  e  is  reducible  at  a  point  t  in  a  computation  if  and  only  if  a  reduced  value 
of  e  can  be  computed  at  t,  i.e., 

1.  e  is  a  simple- value  or  a  tuple,  in  which  case  the  reduced  value  of  e  is  e, 
or 

2.  value(e)  is  f  and  f  is  reducible,  in  which  case  the  reduced  value  of  e  is 
the  reduced  value  of  /,  or 

3.  e  is  an  expression  and  all  variables  in  e  are  reducible,  in  which  case  the 
reduced  value  of  e  is  computed  by  substituting  the  reduced  value  of  v 
for  each  variable  v  in  e  and  evaluating. 

7.1  Properties  of  Reducibility 

Value  Equals  Reduced  Value  For  all  variables  x,  the  value  of  x  is  equal 
to  its  reduced  value.  This  is  because  the  reduced  value  of  x  is  obtained  from 
the  value  of  x  by  substitution  and  expression  evaluation. 

Unique  Reduced  Values  The  reduced  value  of  an  element  e  at  a  point  in 
a  computation  is  unique.  For  example,  if  the  reduced  value  of  e  is  2  at  a  point 
in  a  computation  then  the  reduced  value  of  e  cannot  also  be  3  at  that  point. 

Mutables  Are  Reducible  A  mutable  is  reducible  at  all  points  in  compu¬ 
tation  and  the  reduced  value  of  a  mutable  is  its  value. 

Undefined  Definition  Variables  Are  Not  Reducible  An  undefined  def¬ 
inition  variable  is  not  reducible  because  the  value  of  an  undefined  definition 
variable  is  a  special  symbol  indicating  that  it  is  undefined,  and  hence  none  of 
the  rules  of  reducibility  can  be  employed  to  compute  a  simple  value  or  tuple 
for  it. 
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Examples  of  Reducibility 

Example  1 

Let  z  be  a.  definition  variable,  and  let  m  be  a  mutable  that  is 
declared  to  be  an  integer.  If  at  a  point  i  in  a  computation, 
value(z)  is  1  and  value (m)  is  2,  then  z  +  m  is  reducible  and  its 
reduced  value  is  3,  at  t. 

If  m  =  4  at  a  later  point  t1,  then  the  reduced  value  of  2  -f  m  is 
5  at  t'. 

Example  2 

If  at  a  point  t  in  a  computation,  y  is  undefined,  then  y  is  not 
reducible  at  t.  If  at  i,  the  value  of  z  is  y  -t-  1,  then  z  is  not 
reducible  at  t  because  y  is  not  reducible  at  t. 

Example  3 

If  at  a  point  t  in  a  computation,  value(z)  is  y  +  1,  and  value^y) 
is  0,  then  2  is  reducible  and  its  reduced  value  is  1  at  t.  Further¬ 
more,  if  2  is  a  definition  variable,  the  reduced  value  of  2  remains 
1  at  all  points  after  t. 
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Defined  Definition  Variables  A  defined  definition  variable  may  or  may 
not  be  reducible.  For  example,  if  value(x)  =  y  +  z,  where  x,  y  and  z  are 
definition  variables,  then  x  is  not  reducible  if  y  or  z  is  not  reducible.  If, 
however,  y  and  z  are  reducible  with  reduced  values  (say)  1  and  2  respectively, 
then  x  is  reducible  and  has  reduced  value  3. 

Once  Reducible,  Remains  Reducible  Once  a  term  is  reducible  it  re¬ 
mains  reducible  forever  thereafter.  The  reasons  for  this  are  as  follows.  Muta- 
bles,  simple- values  and  tuples  are  always  reducible.  Once  a  definition  variable 
is  reducible  it  remains  reducible  because  its  value  remains  unchanged.  Once 
an  expression  (that  can  name  mutables  and  definition  variables  or  both)  is 
reducible  it  remains  reducible. 

Reduced  Values  of  Definition  Variables  The  reduced  value  of  a  defini¬ 
tion  variable  remains  unchanged.  For  example,  if  the  reduced  value  of  z  is  2 
at  some  point  in  a  computation,  then  the  reduced  value  of  z  remains  2  forever 
thereafter.  Likewise,  the  reduced  value  of  an  expression,  that  does  not  name 
mutables,  remains  unchanged.  For  example,  if  the  reduced  value  of  y  +  z  is  3 
at  some  point  in  a  computation  (where  y  and  z  are  definition  variables),  then 
the  reduced  value  of  y  +  z  remains  3  thereafter. 

Reduced  Values  of  Mutables  The  reduced  value  of  a  mutable  can  change; 
for  instance  mutable  m  can  have  value  2  at  some  point  in  a  computation  and 
value  3  at  a  later  point.  Likewise,  the  reduced  value  of  an  expression  that 
names  mutables  can  change.  For  example,  the  value  of  expression  y  +  z  +  m 
can  change,  where  m  is  a  mutable,  because  m  can  change  value. 
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More  Examples  of  Reducibility 

Example  4 

If  at  a  point  t  in  a  computation,  value^y^  =  -[1  ,  z},  then  y  is 
reducible  and  its  reduced  value  is  {1,  z}  at  t.  Note  that  y  is 
reducible  even  if  z  is  not  reducible. 

Example  5 

If  at  a  point  t  in  a  computation,  value  (y)  =  A ,  where  A  is  an 
integer  array,  then  y  is  reducible,  and  its  reduced  value  is  A  at 
t. 

Example  6 

If  at  a  point  t  in  a  computation,  value{y )  =  x-j-1,  and  value(x')  = 
2*y— 2,  then  both  x  and  y  are  nonreducible  at  t.  (Note  that  from 
the  mathematics  of  simultaneous  equations  we  can  conclude  x  — 
0  and  y  =  1,  but  according  to  our  definitions  x  and  y  are  not 
reducible.) 
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8  Assignment  Statements 

The  syntax  of  an  assignment  statement  is: 


assignment- statement  ::  mutable  :=  expression 


The  execution  of  the  assignment  statement  m  :=  rhs  where  rhs  is  an  ex¬ 
pression  and  m  is  a  mutable  variable,  declared  to  be  one  of  the  types  in  C,  is 
as  follows: 


repeat  skip  until  rhs  is  reducible; 
assign  the  reduced  value  of  rhs  to  m. 


A  skip  is  an  operation  that  does  nothing,  and  it  is  sometimes  referred 
to  as  a  ‘no-op.’  Therefore,  while  rhs  is  not  reducible,  the  program  executes 
operations  that  do  nothing  —  in  other  words,  the  program  waits.  When 
rhs  becomes  reducible,  the  reduced  value  of  rhs  (coerced  to  be  the  same 
type  as  m)  is  assigned  to  m,  and  the  assignment  completes.  If  rhs  never 
becomes  reducible  the  assignment  does  not  complete,  and  execution  of  the 
assignment  statement  is  an  infinite  number  of  skips.  Note  that  if  rhs  does  not 
reference  definition  variables,  the  assignment  statement  is  executed  without 
skips,  because  rhs  is  reducible;  in  this  case  the  assignment  is  executed  in  the 
same  way  as  assignments  in  C. 
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Simple  Examples  of  Assignment 

Right-Hand  Side  Does  Not  Reference  Definition 
Variables 

int  ra,  i,  j ,  u[10],  u[10]; 

m  :=  i+j ,  u  :=  v,  ... 

The  assignment  m  :=  i+j  is  executed  in  the  same  way  as  the 
assignment  m  =  i+j  in  C:  the  sum  of  the  values  of  the  integers 
i  and  j  is  assigned  to  m. 

The  assignment  u  :  =  v  makes  u  become  the  array  v. 
Right-Hand  Side  References  Definition  Variables 

int  m; 

m  :=  z,  ... 

The  assignment,  m  :=  z ,  where  m  is  an  integer  mutable,  and 
z  is  a  definition  variable,  is  executed  as  follows.  While  2r  is  not 
reducible,  skip.  When  z  becomes  reducible,  assign  its  value  (co¬ 
erced  to  integer)  to  m.  If  z  never  becomes  reducible,  execution 
of  the  assignment  does  not  complete. 
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9  Program  Calls 

The  syntax  of  a  program  call  is: 


program-call  ::  program-name(-<  term  y)  \ 

' definition-variable (-<  term  >-) 


A  program  call  program-name(-<  term  >-)  is  the  same  as  a  function  call  in 
C,  except  that  all  parameter  passing  is  by  reference,  and  the  program  does  not 
return  a  value  (in  the  way  that  a  function  does).  Later,  we  will  describe  two 
modifications  to  this  syntax  that  allow  programmers  to  specify  processors  on 
which  called  programs  are  to  be  spawned,  and  modules  (files)  that  contain  the 
source  texts  of  the  called  programs;  these  do  not  change  the  essential  meaning 
of  program  calls. 

9.1  Calling  C  programs  from  PCN 

PCN  programs  can  call  C  programs.  The  actual  parameters  in  a  call  to  a 
C  program  can  be  definition  variables  or  mutables.  All  parameter  passing  in 
PCN  is  by  reference;  hence,  the  arguments  of  the  C  program  must  be  pointers 
to  simple-values  (i.e.,  char,  int,  or  double).  The  execution  of  a  C  program  call 
is  as  follows: 


repeat  skip  until  all  actual  parameters  are  reducible; 
execute  the  C  program. 


We  do  not  specify  the  behavior  of  PCN  programs  that  call  C  programs 
which  continue  execution  for  ever;  therefore,  programmers  must  ensure  that 
C  programs  terminate. 
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Examples  of  Calls  to  Programs 

Consider  the  C  program: 

q(v,w,x) 
int  *v,  *w,  *x; 

{  *v  =  *v  —  *X",  *w  =  *w  +  *x  } 

The  execution  of  the  call  q(a,  b,  z),  where  a  and  b  are  muta¬ 
ble  integer  variables  and  z  is  a  definition  variable,  is  as  follows: 
repeat  skip  until  z  is  reducible;  when  z  becomes  reducible,  ex¬ 
ecute  q(v,w,z')  where  z'  is  the  reduced  value  of  z.  Note  that 
even  though  z  is  a  definition  variable,  and  its  value  cannot  be 
changed  by  the  C  program,  2  is  passed  by  reference  and  not  by 
value.  That  is  why  the  type  declaration  of  formal  parameter,  x , 
is  int  *x\  and  not  ‘int  x\  Definition  variable  z  must  reduce  to 
an  integer  value  because  the  corresponding  formal  parameter  x 
is  a  pointer  to  an  integer. 

Consider  the  PCN  program: 

P(w,x,y,z) 

{||  y  =  w  +  X,  z  =  w  —  x} 

A  call  p(a,b ,  c,  d)  of  program  p  causes  program  p  to  be  executed, 
even  if  actual  parameters  are  not  reducible.  We  will  see  later  that 
the  program  completes,  and  at  completion  value(c)  is  a  +  b  and 
value {df  is  a  —  b,  regardless  of  whether  a  or  b  are  reducible. 
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9.2  Calling  Fortran  Programs  from  PCN 

Fortran  programs  are  called  in  the  same  way  as  C  programs.  Parameter  passing 
in  Fortran  is  by  reference,  as  it  is  in  PCN. 

9.3  Calling  PCN  Programs  from  PCN 

PCN  programs  can  call  PCN  programs;  the  actual  parameters  of  the  call  can 
be  mutables  or  definition  variables.  The  called  program  is  initiated  even  if 
some  or  all  of  the  actual  parameters  are  not  reducible. 

There  is  a  difference  between  the  execution  of  calls  to  C  programs  and  PCN 
programs.  A  called  C  program  is  initiated  only  when  all  its  actual  parameters 
are  reducible.  A  called  PCN  program  is  initiated  without  waiting  for  all  its 
actual  parameters  to  be  reducible.  (A  strict  semantic  is  used  for  C  calls  and 
a  nonstrict  semantic  for  PCN  calls.) 

Types  of  actual  parameters  should  be  the  same  as  types  of  corresponding 
formal  parameters  in  calls  to  PCN  programs.  In  particular,  an  actual  param¬ 
eter  should  be  a  definition  variable  if  and  only  if  the  corresponding  formal 
parameter  is  a  definition  variable. 

9.4  Program  Names  as  Actual  Parameters  of  Programs 

A  program-name  can  be  passed  as  an  argument  of  a  program.  To  distinguish 
a  variable  whose  value  is  a  program  name  from  a  program  name,  the  symbol 
is  employed.  For  example  y(x)  is  a  call  of  program  y,  whereas  'y(x)  is  a  call 
to  a  program  g ,  where  the  reduced  value  of  y  is  "g". 

Recall  that  f(x0,  ...,xk)  represents  the  tuple  x0, a:*,}.  Similarly 

'/ (^o,  •  •  • ,  xk)  represents  the  tuple  {/,  x0, . . . ,  xk). 

The  program  call  'y(x)  where  a:  is  a  list  of  actual  parameters  and  y  is  a 
definition  variable,  is  executed  as  follows: 


repeat  skip  until  y  is  reducible; 

execute  g(x)  where  "g"  is  the  reduced  value  of  y. 
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Example  of  a  Program  Name  as  A  Parameter 

Next,  consider  a  program  map,  which  has  a  formal  parameter 
operator  defined  as  a  string  that  is  a  name  of  a  program. 

map(operator,  1st ,  result) 
int  result ; 

{?  1st  ?=  [head  \  tail)  — > 

{;  'operator [head,  result), 
map(operator,  tail,  result) 

} 

} 


Passing  a  Program  Name  as  a  Parameter 

Calling  the  preceding  program  with  map{"add" ,L,R),  causes 
the  following  block  to  be  executed: 

{?  L  ?=  [head  |  tail]  — > 

{;  add(head,  R),  map(" add" ,  tail,  R)} 
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10  Composed  Blocks 

A  composed  block  has  the  following  syntax. 


composed-block 


{;  -<  block  M1)  }  | 

{||  -<  block  yW  }  | 

{?  -<  guard  — >  block  } 


where  denotes  sequential  composition,  ‘||’  denotes  parallel  composition,  and 
‘?’  denotes  choice  composition. 


11  Sequential  Composition 

Let  d  be  the  block  {;  where  k  >  0.  The  execution  of  d  is  a 

sequential  execution  of  in  order,  from  *  =  1  to  i  =  k. 

12  Parallel  Composition 

Let  d  be  the  block  {||  &i, . . . , bk},  where  k  >  0,  and  for  all  i  where  0  <  i  <  k, 
b{  is  a  block.  In  an  execution  of  d,  all  blocks  b{  are  executed  in  parallel.  Block 
d'  terminates  when  the  computations  of  6,  terminate  for  all  i.  (A  computation 
°f  d  is  a  fair  interleaving  of  computations  of  for  all  i,  0  <  i  <  k.  Execution 
is  fair  in  the  following  sense:  For  all  i,  it  is  always  the  case  that  eventually 
computation  of  will  progress  if  has  not  terminated.) 

Programmers  must  ensure  that  the  following  condition  about  shared  vari¬ 
ables  is  satisfied. 

Restriction  on  Shared  Variables  in  Parallel  Composition  Shared  mu- 
tables  must  not  change  value  during  parallel  composition. 
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Example  of  Sequential  Composition 


p{h  k,  x,  y) 
int  j,  k,  m\ 

/*  Let  the  value  of  j  he  J.  */ 

/*  m  is  a  local  integer  mutable  of  p  */ 

{; 

m  :=  2, 

/*  value(m)  is  2  */ 
x  =  m  +  1, 

/*  The  reduced  value  of  x  is  3.  */ 
k  :=y+j 

/*  value(k)  is  sum  of  the  */ 

/*  reduced  values  of  y  and  j.  */ 


First  m  becomes  2,  then  x  is  defined  as  2  +  1  (and  hence  its  re¬ 
duced  value  is  3),  and  then,  after  executing  skips  until  y  becomes 
reducible,  x  becomes  the  sum  of  the  values  of  y  and  j. 
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This  restriction  is  equivalent  to:  In  a  parallel  composition  block  d  defined 
as  {|| 

for  each  variable  v  accessed  in  distinct  blocks  6*  and  bf. 

1.  v  remains  unchanged  during  the  execution  of  d,  or 

2.  v  is  a  definition  variable. 

For  this  purpose,  each  element  of  a  shared  array  is  treated  as  separate  variable; 
therefore,  blocks  composed  in  parallel  can  modify  a  shared  array,  but  each 
dement  of  the  array  must  remain  unchanged  or  be  accessed  by  at  most  one 
block.  Similarly,  each  element  of  a  tuple  is  treated  as  a  separate  element. 

An  important  consequence  of  this  restriction  is  that  blocks,  composed  in 
parallel,  interact  with  each  other  in  a  disciplined  manner.  Consider  a  predicate 
^  that  references  only  variables  that  appear  in  one  of  the  constituent  blocks, 
say  bi  of  parallel  composition  block  d.  For  example,  z  could  be  u  =  v  +  1, 
where  u  and  v  are  variables  referenced  in  block  Suppose  we  can  reason  from 
the  text  of  block  bt  (i.e.,  by  considering  block  k  in  isolation,  independent  of 
the  blocks  that  &,•  is  composed  with)  that  predicate  z  holds  at.  some  nnint.  n  in 


Example  of  Parallel  Composition 

(II  P(j,k,x,y),  y  =  x+j} 

(Program  p  is  defined  in  the  previous  example.)  This  parallel 
composition  block  obeys  our  convention  about  shared  variables. 
The  only  shared  mutable  is  j  which  is  not  modified  in  the  block. 
Let  the  value  of  j  be  1  when  this  block  is  executed.  The  compu¬ 
tation  of  this  block  terminates,  and  at  termination,  the  reduced 
value  of  x  is  3,  and  y  is  4,  and  k  is  5. 

A  possible  computation  of  the  parallel  composition  block  is:  y 
is  defined  as  x  +  1  (assuming  j  =  1),  then,  in  program  p:  m 
becomes  2,  then  x  becomes  defined  as  2+1,  and  finally  k  becomes 
5.  Note  that  y  can  become  defined  before  x  becomes  defined. 
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13  Choice  Composition 

A  choice  composition  block  is  similar  to  a  guarded  command  [5].  A  guard  in  a 
choice  composition  block  is  a  boolean  expression  or  the  keyword  default.  At 
a  point  in  a  computation,  a  boolean  expression  is: 

1.  not  reducible,  or 

2.  reducible  and  has  value  true,  or 

3.  reducible  and  has  value  false. 

We  shall  see  later  that  once  a  guard  is  reducible  it  remains  reducible  for  ever 
thereafter. 

There  can  be  at  most  one  default  guard  in  a  choice  composition  block.  A 
choice  block  without  a  default  guard  is  equivalent  to  a  choice  block  with  the 
addition  of  the  guarded  block:  default  —  >  skip,  therefore,  we  can  restrict 
attention  to  choice  blocks  that  contain  precisely  one  default  guard. 

The  basic  idea  about  execution  of  the  choice  block: 

{?  default  ->  b0,  Gx  ->  bx,  ...  ,  Gk  ->  bk  } 


is  as  follows: 

1.  If  all  guards  are  false  then  execute  60;  execution  of  the  choice  block 
terminates  when  execution  of  b0  terminates. 

2.  If  at  least  one  guard  is  true  then  execute  any  block  b,  where  Gi  is  true ; 
execution  of  the  choice  block  terminates  when  execution  of  &,•  terminates. 

3.  Because  guards  can  be  nonreducible,  there  is  a  third  possibility:  at  least 
one  guard  is  nonreducible  and  no  guard  is  true.  In  this  case  the  program 
repeatedly  executes  skips  until  one  of  the  first  two  conditions  holds. 
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Examples  of  Choice  Blocks 


Example  1 

Consider  the  choice-block: 

{?  x  >=  0  — >  y  =  x  +  1, 

X  <  =  0  — >  y  —  x  —  1 

} 

The  execution  of  this  block  is  as  follows.  While  x  is  irreducible, 
skip.  When  x  becomes  reducible,  if  x  >  0,  then  only  the  first 
guard  holds,  and  hence  y  is  defined  as  x  +  1;  if  x  <  0,  then  only 
the  second  guard  holds,  and  hence  y  is  defined  as  x  -  1;  if  x  =  0, 
then  both  guards  hold,  and  a  nondeterministic  choice  is  made 
to  define  y  either  as  x  +  1,  or  as  x  —  1.  Execution  of  the  block 
terminates  after  y  is  defined. 

Example  2 

Consider  the  choice-block: 

{?  x  >=  0  — >  y  =  x  +  1  } 

The  execution  of  this  block  is  as  follows.  While  x  is  irreducible, 
skip.  When  x  becomes  reducible:  if  x  >  0  then  y  is  defined  as 
x  +  1  else  y  is  left  unchanged;  execution  of  the  block  terminates. 
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13.1  Guards 


A  guard  is  either  a  sequence  of  one  or  more  guard  elements  or  default.  The 
syntax  of  a  guard  is: 


guard  ::  -<  guard-element  M1)  |  default 


Case  1:  If  All  Guard-Elements  are  Reducible  If  all  the  guard-elements 
of  a  guard  G  are  reducible,  then  G  is  reducible,  and  the  value  of  G  is  a 
conditional- and  of  its  guard-elements:  Each  of  the  guard-elements  in  the 
sequence  is  evaluated  in  order  until  all  guard-elements  in  the  sequence  are 
evaluated  or  a  guard-element  evaluates  to  false]  if  all  guard-elements  evaluate 
to  true  the  value  of  the  guard  is  true ,  otherwise  the  value  of  the  guard  is  false. 
The  evaluation  of  a  guard  is  similar  to  the  evaluation,  in  C,  of  an  expression 
consisting  of  the  sequence  of  guard-elements  with  the  logical  connective  && 
between  guard-elements. 

Case  2:  At  Least  One  of  the  Guard-Elements  is  Irreducible  Next, 
consider  the  case  where  at  least  one  of  GJ s  guard-elements  is  irreducible:  If 
all  guard-elements  before  the  first  nonreducible  element  of  G  evaluate  to  true , 
then  G  is  not  reducible;  otherwise,  G  =  false. 

13.2  Guard-Elements 

The  syntax  of  a  guard-element  is: 


guard-element  ::  type-check  |  comparison  \ 
data-check  |  pattern-match 
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Another  Example  of  a  Choice  Block 


Example  3 

Consider  the  choice-block: 

{?  x  >=  0  — >  y  =  x  +  1, 
z  >=  0  — >  y  =  z  +  1 

} 

Repeat  skips  until  both  guards  are  reducible  and  both  have  re¬ 
duced  value  false,  or  at  least  one  of  the  guards  is  reducible  and 
has  reduced  value  true.  In  the  former  case  the  choice  block  ter¬ 
minates  without  changing  the  value  of  any  variable.  In  the  latter 
case,  if  both  guards  have  reduced  value  true  then  execute  either 
y  =  x  +  1  or  y  =  z-\-l,\{  only  x  >  0  has  reduced  value  true  then 

execute  y  —  x  +  1,  and  if  only  z  >0  has  reduced  value  true  then 

execute  y  =  z  +  1. 


39 


Type  Checks  The  syntax  for  type-check  is: 


type-check  ::  type-name(definition-variable ) 
type-name  ::  int  |  double  |  char  |  tuple 


If  x  is  not  reducible,  type-check  h(x)  is  not  reducible.  If  x  is  reducible, 
type-check  h(x)  evaluates  to: 

1.  true  if  the  reduced  value  of  x  is  of  type  h  or  is  an  array  of  type  h , 

2.  false  otherwise. 

For  example,  if  x  is  reducible,  then  int(x)  holds  if  and  only  if  the  reduced  value 
of  x  is  an  integer  or  an  array  of  integers. 

Comparison  The  syntax  of  a  comparison  is: 


comparison  ::  term  equality-test  term  \ 

expression  ordering  expression 
equality-test  ::  ==  |  !  = 
ordering  ::  <  |  <=  |  >  |  >= 


A  comparison  x  a  y,  where  a  is  an  ordering,  is  reducible  if  and  only  if 
both  x  and  y  are  reducible;  the  reduced  values  of  x  and  y  must  be  numbers  or 
arrays.  Numbers  and  strings  contained  in  character  arrays  are  compared  as  in 
C;  integer  and  double  arrays  are  compared  consecutively  by  element. 

A  comparison  x  a  y,  where  a  is  an  equality-test,  is  reducible  only  if  both 
x  and  y  are  reducible.  An  equality-test  x  ==  y,  where  the  reduced  values  of 
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Example  of  Type  Check  and  Comparison 
{?  int(ar),  x  >=  y  ->  z  =  x  +  1  } 

Consider  the  case  where  y  is  irreducible  and  x  is  reducible.  If 
the  reduced  value  of  x  is  an  integer,  then  the  guard,  is  not  re¬ 
ducible  because  the  first  guard-element  evaluates  to  true  and  the 
second  guard-element  is  not  reducible.  If  the  reduced  value  of 
a:  is  a  character,  then  the  guard  evaluates  to  false,  because  the 
first  guard-element  evaluates  to  false. 

Next  consider  the  same  program  except  that  the  order  of  guard- 
elements  is  reversed. 

{?  x  >=  y,  int(ar)  ->  z  =  x  +  1  } 

As  before,  consider  the  case  where  y  is  irreducible  and  x  is  re¬ 
ducible.  As  in  the  last  example,  if  the  reduced  value  of  x  is 
an  integer,  then  the  guard,  is  not  reducible  because  the  first 
guard-element  is  not  reducible.  If  the  reduced  value  of  x  is 
a  character  then  the  guard  is  not  reducible  for  the  same  rea¬ 
son.  Note  that  in  the  previous  example,  if  a:  is  a  character 
the  guard  is  reducible.  This  example  shows  that  the  ordering 
of  guard-elements  can  make  a  difference  to  the  computation. 
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x  and  y  are  tuples,  is  equivalent  to  the  following  sequence  of  equality-tests: 

length(x)  ==  length(y),  and  for  all  i  where  0  <  i  <  length(x):  x[i\  ==  y[i]. 

Thus,  equality  tests  of  tuples  are  equivalent  to  sequences  of  equality-tests 
without  tuples.  A  comparison  x  ==  y  is  reducible  if  x  and  y  reduce  to  simple 
values.  Equality  of  characters  and  numbers  is  as  in  C. 

Inequality  is  defined  as  the  negation  of  equality. 

Data  Check  The  syntax  of  a  data-check  is: 


da.ta-check  ::  data  (definition-variable) 


If  x  is  reducible  then  data(s)  =  true.  If  x  is  not  reducible,  then  data(ar)  is 
also  not  reducible.  The  value  of  data(a;)  is  never  false. 
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Testing  Equality  of  Tuples 
{?  x  —=  y  ->  p(x)  } 

In  the  equality  test,  x  or  y  can  be  tuples  (and  therefore  can  be 
lists).  If  x  =  [0, 1,2],  then  the  equality  test  succeeds  only  if  y  is 
equal  to  the  same  list.  If  y  is  [0, 1| z],  where  z  is  a  nonreducible 
definition  variable,  then  x  ==  y  is  not  reducible. 

As  another  example,  consider  the  case  where  the  reduced  value 
°f  x  is  z  and  the  reduced  value  of  y  is  also  z.  The  equality  test  is 
reducible  if  and  only  if  z  is  reducible.  Of  course,  if  z  is  reducible, 
the  equality  test  succeeds. 
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13.3  Pattern  Matches 

A  pattern-match  is  merely  a  syntactic  convenience  for  operating  on  tuples.  It 
has  the  following  syntax: 


pattern-match  ::  variable  ?=  pattern 

pattern  ::  {-~<  pattern- element  >-} 

pattern-element  ::  simple-value  \  definition-variable  \  pattern 


A  pattern- match  x  1  —  pat  succeeds  (i.e.,  has  reduced  value  true)  if  the 
reduced  value  of  x  is  a  pattern  of  the  same  ‘form’  as  the  pattern,  pat ,  on  the 
right.  For  example,  if  pat  is  {u,v},  then  the  match  succeeds  if  the  reduced 
value  of  a:  is  a  tuple  of  size  2.  If  a  match  succeeds,  a  variable  in  the  pattern 
become  an  alias  for  the  corresponding  element  of  the  tuple  for  the  remainder 
of  the  guard  and  its  associated  block.  Thus  the  pattern-match  x  ?=  {u,u} 
succeeds  if  x  is  the  2-tuple  {a;[0],  x[l]},  and  if  the  match  succeeds  then  u 
becomes  an  alias  for  ar[0],  and  v  becomes  an  alias  for  ®[1]  for  the  remainder 
of  the  guard  and  its  associated  block.  Next,  matches  are  discussed  in  more 
detail. 

Evaluation  of  a  Pattern-Match  A  definition  variable  that  appears  in  a 
pattern  must  be  undefined  when  the  pattern-match  is  evaluated.  Mutables 
cannot  appear  in  patterns. 

A  pattern  match,  z  ?=  pat  can  be  transformed  into  a  sequence  of  guard- 
elements  without  the  pattern  match  by  the  following  syntactic  transformation: 
Replace  the  pattern  match  by, 

tuple(z),  (length(z)  =—  length(pat )) 
and  for  each  i,  where  0  <  *  <  length(z),  if  pat[i]  is  a 
pattern  add  the  pattern-match,  z[i)  ?=  pat[i], 
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Simple  Patterns 

In  the  following  example,  z,  hd  and  tl  are  definition  variables 
that  are  undefined  at  the  point  at  which  the  pattern  matches 
are  executed. 

-2  ?—  {hd,  tl}  — >  {||  hd  =  u,  v  =  tl} 
is  equivalent  to: 

tuple(z),  length(z)  ==  2  ->  {||  z[0]  =  u,  v  =  z[  1]} 

The  match  2  ?=  {hd,  tl}  succeeds  if  2  is  a  tuple  of  the  same 
form  as  {hd,  tl},  i.e.,  if  z  is  a  2-tuple.  If  the  match  succeeds, 
then  hd  is  an  alias  for  2[0],  and  tl  is  an  alias  for  ^[1]  in  the  re¬ 
mainder  of  the  guard  and  its  associated  block. 
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simple-value  add  the  equality-test,  z[i\  ==  pat\i\, 

definition  variable  replace  all  instances  of  pat [*]  by  z[i]  in  the  remainder  of 
the  guard  and  its  associated  block. 
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Patterns  with  Strings  and  Numbers 

z  ?=  {v,{y}>2"™sg"}  ->  {||^  =  y} 

is  equivalent  to 

tuple(z),  ( length{z )  ==  4), 
(tuple(z[l]),(length(z[l])  ==  1)), 

(*[2]  ==  2),  (*[3]  ==  "msg")  -> 

(II  40]  =  z[l][0]} 


The  match  succeeds  if  the  reduced  value  of  z  is  the  same  form  as 
the  pattern,  i.e.,  if  z’s  reduced  value  is  a  4-tuple  where  2 [3]  and 
z[ 4]  are  the  integer  2  and  the  string  " msg ",  respectively,  and 
where  the  form  of  z[l]  is  the  pattern  {?/}.  If  the  match  succeeds, 
v  and  z [0]  are  aliases  of  each  other,  and  likewise,  y  and  s[l][0] 
are  aliases  of  each  other. 

Patterns  with  Lists 

z  ?=  |  %]  — >  {;sum  :=  sum  +  w,  p(sum,x)} 

is  equivalent  to 

tuple(z),length(z )  ==  2,  — > 

{;  sum  :=  sum  +  z[0],  p(sum,z[  1])} 
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14  Syntactic  Sugar:  Composition  of  Guarded 
Statements 

The  syntax  that  we  gave  for  composed  blocks  was: 


composed-block 


{;  -<  block  M1)  }  | 

{||  -<  block  yW  }  I 

{?  -<  guard—  >  block  y^  } 


Thus  parallel  and  sequential  composition  compose  blocks  but  not  guard -> 
blocks.  For  notational  convenience  we  relax  this  syntax  to  allow  parallel  and 
sequential  composition  of  guard  — >  blocks.  Each  guard ->  block  is  trans¬ 
formed  into  the  choice  block  {?  guard  —  >  block}.  The  sugared  syntax  is: 


composed-block 


{;  -<  unit  M1)  }  | 

{||  -<  unit  }  | 

{?  -<  guard  —>  block  M1)  } 


unit  ::  block  \  guard  —>  block 


We  may  find  it  convenient  to  think  of  all  composition  blocks  as  consisting 
of  a  composition  operator  operating  on  a  list  of  guard  —>  block ,  where  some 
guards  can  be  true. 
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Examples  of  Syntactic  Sugar 

The  following  programs,  the  first  with  the  added  sugar,  and  the 
second  without  it,  are  equivalent: 

{?  t  ?=  {left,  val,  right}  ->  {||  f  (left,  l), /(right,  r), 

l  >=  r  —>  2  =  1  +  /, 
r  >=  /  ->  z  =  l  +  r 


g(t,z) 

{?  t  ?=  {left, val, right]  ->  {||  g(left,l),g(right,r), 

{?  I  >=  r  —>  2  =  1  +  /}, 
{?  r  >=  /  ->  2=1+  r} 


} 


} 


The  Variable  Name  There  are  a  few  places  where  we  would  like  to  refer 
to  a  variable  that  we  do  not  wish  to  use  later.  For  instance,  we  may  want  a 
pattern  with  3  elements,  but  we  wish  to  use  only  the  first  of  the  3  elements. 
Instead  of  coming  up  with  names  for  the  remaining  two  elements  we  can  use 
‘J  as  a  name  for  both  elements.  Each  instance  of  is  treated  as  the  name  of 
a  new  unique  variable. 


15  Built-In  Programs  and  I/O 

make_tuple  One  of  the  built-in  programs  provided  in  PCN  is  makeJuple 
which  has  two  arguments,  n  and  x  where  s  is  a  definition  variable  that  is 
defined  by  makeJuple  and  n  is  a  variable  unchanged  by  the  program.  The 
program  defines  x  to  be  a  tuple  of  n  elements,  where  n  is  a  nonnegative 
integer,  where  each  element  of  a;  is  a  definition  variable.  (If  n  <  0  then  x  is 
defined  to  be  the  empty  tuple.)  The  elements  of  tuple  x  are  left  undefined  by 
makeJuple.  For  example,  makeJuple( 2,  x )  defines  x  to  be  a  2-tuple,  leaving 
definition  variables  ar[0]  and  x[l]  undefined. 

The  program  call  makeJuple(n,x)  is  executed  as  follows: 


repeat  skip  until  n  is  reducible; 

coerce  n  to  integer  (if  necessary); 

if(n  >  0)  define  i  to  be  a  tuple  with  n  elements 

else  define  i  to  be  a  tuple  with  0  elements. 


I/O  A  standard  I/O  library  is  available  in  the  system  library  stdio.pcn.  This 
library  deals  with  formatted  I/O  as  in  C  but  also  allows  for  manipulation  of 
definition  variables. 
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An  Example  Using  Variable  Name 


p(x 
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}  |  ars]  — > 

{; 

g(m,n), 

z 

=  in  1  zs),  p(xs , 

2:5)} 
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16  Architectures,  Implementation  and  Effi¬ 
ciency 

The  speed  of  execution  of  a  PCN  program  depends  on  its  implementation.  To 
understand  how  to  develop  programs  that  execute  quickly,  programmers  need 
to  understand  something  about  the  implementation  of  PCN.  The  implemen¬ 
tation  may  change  in  future  releases,  but  the  central  ideas  about  efficiency  are 
not  likely  to  change  significantly. 

Uniprocessors,  Multiprocessors,  and  Multicomputers  PCN  programs 
run  on  uniprocessors,  multiprocessors  or  mn1t.irnmnnt.prq  A  m„lt  1  nrn  roocTvr 


Consider  a  block  b  in  a  program  p.  If  b  references  mutables  (declared  in  p) 
then  b  is  executed  in  the  address  space  in  which  p  is  initiated.  This  is  because 
there  is  only  one  copy  of  a  mutable,  and  all  blocks  that  access  a  mutable 
are  executed  in  the  address  space  in  which  the  mutable  resides.  If  b  does 
not  reference  mutables  then  b  can  be  executed  in  any  address  space;  copies 
of  definition  variables  are  made  in  the  address  space  in  which  b  is  executed, 
as  needed  by  b.  The  greatest  degree  of  concurrent  execution  is  achieved  by 
employing  parallel  composition  in  which  the  blocks  composed  in  parallel  do 
not  share  mutables;  this  allows  blocks  to  be  spawned  on  arbitrary  address 
spaces  and  thus  employs  concurrency  in  multicomputers  and  multiprocessors. 

Granularity  If  the  execution  time  of  a  block  is  small,  the  time  required  to 
spawn  the  block  in  a  remote  address  space  may  exceed  the  time  gained  from 
concurrent  execution  of  the  block.  Therefore,  programmers  should  ensure 
that  block  granularity  in  parallel  composition  is  appropriate  for  the  target 
architecture. 
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17  Simple  Programming  Examples 

17.1  Membership  in  a  List 

Develop  a  program  member  with  arguments  x ,  m  and  r,  where  a;  is  a  list,  m 
and  r  are  mutables,  and  at  termination  of  execution  of  the  program,  r  =  true 
if  and  only  if  m  appears  in  list  x.  Mutable  m  is  to  be  left  unchanged  by 
member.  Of  course,  definition  variable  x  must  be  left  unchanged  by  member. 

member(x,  m,  r) 
int  m,  r; 

{?  x  ?=  [] 

x  ?=  [u|xs],  V 
X  ?=  [u|xs],  V  ! 

} 

Assume  that  false  =  0  and  true  =  1,  to  be  consistent  with  C. 

Operation  of  the  Program 

1.  If  x  is  the  empty  list,  then  r  becomes  false  and  the  program  terminates. 

2.  If  x  is  nonempty,  let  the  head  of  x  be  v,  and  let  the  tail  of  x  be  xs:  if 
v  =  m  then  r  becomes  true  and  the  program  terminates. 

3.  If  x  is  nonempty  and  the  head  of  x  is  not  m,  then  the  value  of  r  is  set 
by  member  (xs,m,r),  and  member(x,m,r)  terminates  execution  when 
member(xs ,  m,  r)  does. 

Reasoning  About  the  Program  In  many  examples  we  reason  about  the 
correctness  (and  the  efficiency)  of  programs  by  induction.  In  this  example,  we 
carry  out  induction  on  the  length  of  x.  (The  length  of  a  list  is  the  number  of 
elements  in  it.) 

Base  Case:  If  x  is  the  empty  list  then  r  is  false  upon  termination  because 
m  does  not  appear  in  an  empty  list. 


— >  r  :=  false, 

==  m  — >  r  :=  true, 

=  m  — >  member(xs,m,r ) 
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Induction  Step:  Assume  that  member(x,m,r)  is  correct  (i.e.,  it  ter¬ 

minates  with  the  correct  values  of  its  arguments)  for  all  lists  x  that  have  at 
most  k  elements,  for  some  k  >  0,  and  prove  that  it  is  correct  for  lists  with 
k  +  1  elements.  If  x  has  k  +  1  elements  it  has  a  head  element.  Let  the  head  of  x 
be  v  and  let  the  tail  of  x  be  xs ;  then  xs  has  k  elements.  If  v  =  m  then  r  must 
be  true  at  termination  of  the  program  because  m  is  in  list  x.  If  v  ^  m,  then 
at  termination  r  is  true  if  and  only  if  m  is  in  xs\  by  the  induction  assumption, 
member(xs,  m,  r)  sets  r  to  true  if  and  only  if  m  is  in  xs. 

A  Program  with  Definition  Variables  Now  consider  a  program  with  the 
same  specification,  except  that  m  and  r  are  definition  variables,  where  m  is  left 
unchanged  by  the  program,  and  r  is  defined  by  the  program.  All  we  need  to 
do  is  to  remove  the  declaration  of  m  and  r,  and  replace  assignment  statements 
by  definition  statements. 

member l(x,  m,  r) 

{?  x  ?=  [  ]  — >  r  —  false, 

x  ?=  [u|a:a],  v  =—  m  ->  r  —  true , 

x  ?=  [n|a;a],  v!=  m  — >  member \(xs,m,r) 


17.2  Sum  all  Elements  in  a  List 

Develop  a  program  sum  with  arguments  x  and  r,  where  a:  is  a  list  of  integers 
and  r  is  a  mutable  integer.  At  termination  of  execution  of  the  program,  r  is 
required  to  be  the  initial  value  of  r  plus  the  sum  of  the  elements  of  x.  List  x 
is  to  be  left  unchanged.  For  example,  if  x  =  [1,2,3]  and  r  =  4  initially,  then 
r  =  10  at  termination  of  the  program. 

sum(x,  r) 
int  r; 

{?  x  ?=  [u|a;5]  — >  {;  r  :=  r  +  v,  sum(xs,r)} 
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Operation  of  the  Program  In  this  program: 

1.  If  £  is  the  empty  list  the  program  terminates  leaving  r  unchanged. 

2.  If  x  is  nonempty,  let  v  be  the  head  of  x  and  let  xs  be  the  tail  of  x ; 
mutable  r  becomes  r  +  v,  and  then  sum(xs,  r)  is  executed. 

Reasoning  About  the  Program  Let  rl  be  the  initial  value  of  r,  and  let  rf 
be  the  value  of  r  when  program  sum  terminates  execution.  We  reason  about 
the  program  by  inducting  on  the  length  of  x. 

Base  Case:  If  x  is  the  empty  list,  the  program  terminates  and  r  is  left 
unmodified,  and  hence  =  r',  as  required. 

Induction  Step:  Assume  that  program  sum{x,  r)  is  correct  for  all  lists 
x  with  length  at  most  k ,  for  some  k  >  0,  and  prove  that  it  is  correct  for  lists  x 
with  length  k  +  1.  If  the  length  of  x  is  k  +  1  then  x  is  nonempty;  let  v  be  the 
head  of  x  and  let  xs  be  the  tail  of  x.  List  xs  has  length  k.  From  the  induction 
assumption,  sum(xs ,  r)  is  correct.  Hence  =  r*  +  sum  of  elements  in  xs. 
and  hence  is  the  sum  of  rl  and  the  sum  of  all  elements  of  a;,  as  required  by 
the  specification, 

Another  Summation  Example  Next  we  write  a  program  total  to  define 
a  definition  variable  z  as  the  sum  of  all  the  elements  of  a  list  x.  The  difference 
between  this  program  and  the  previous  one  is  that  2  is  definition  variable 
whereas  r  is  mutable,  and  furthermore  2  is  to  be  the  sum  of  the  elements  of  x, 
whereas  the  sum  of  the  elements  of  x  was  added  to  r  in  the  previous  program. 

total(x,  2 ) 
int  r; 

{;  r  :=  0,  sum(x,r),  z  =  r} 

An  alternate  version  totall,  using  only  definition  variables  and  parallel 
composition,  is  given  next. 
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total  l(a;,  z) 

{?  x  ?=  [  ]  ->  z  =  0, 

xl=  [t;|®5]  — >  {||  z  =  zs  +  v,  totall(xs,  zs)} 


Operation  of  the  Program  The  operation  of  this  program  is  as  follows. 

1.  If  x  is  the  empty  list  then  definition  variable  z  is  defined  to  be  0. 

2.  If  x  is  nonempty,  let  v  be  the  head  of  x  and  let  xs  be  the  tail  of  x.  Define 
definition  variable  z  to  be  the  expression  zs  +  v,  where  zs  is  defined  by 
totall(xs,  zs). 

Reasoning  About  the  Program  We  are  obliged  to  ensure  that  blocks  in 
parallel  composition  do  not  modify  shared  mutables.  This  program  has  no 
mutables,  and  so  the  restriction  about  shared  variables  holds  vacuously. 

We  reason  by  induction  on  the  length  of  x,  as  in  the  previous  example.  The 
reasoning  is  not  given  here  because  it  is  largely  a  repetition  of  the  arguments 
given  earlier. 

Difference  Between  Programs  Let  x  be  the  list  [1,2].  At  the  termination 
of  total(x,z ),  definition  variable  z  is  defined  to  be  the  number  3.  At  the 
termination  of  totall(x,  z),  definition  variable  z  is  defined  by  the  following 
equations: 

z  =  l  +  a,  where  a  is  defined  by 
a  —  2  +  6,  where  6  is  defined  by 
6  =  0. 

If  we  now  execute  m  z,  where  m  is  a  mutable,  and  then  print  m,  we  will 
get  the  same  answer  whether  we  use  total  or  totall  because  the  reduced  value 
of  z  is  the  same  in  both  cases. 

At  first  glance,  sequential  programs  such  as  total  may  appear  more  efficient 
in  memory  and  time  than  parallel  programs  such  as  totall.  Consider  the 
following  variation  in  which  a  parallel  implementation  can  require  less  time 
than  a  sequential  implementation. 
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17.3  Sum  Function  of  Elements  in  a  List 

Let  x  be  a  list.  Define  z  as  follows:  z  is  the  sum  over  all  elements  of  the  list 
of  a  function  g  applied  to  each  element.  For  example,  if  x  is  [1, 2]  and  g  is  the 
square  operation,  then  z  =  5. 

A  sequential  program  sigma ,  analogous  to  sum  in  the  previous  subsection, 
is  given  next. 

sigma,(x ,  r) 
int  r,  w ; 

{?  x  ?=  [u|a:s] 

} 

Program  f(v,w )  sets  the  value  of  w  to  be  g(v). 

Program  Operation  The  operation  of  this  program  is  as  follows.  If  x  is 
empty  the  program  terminates  with  r  unchanged.  If  x  is  not  empty,  let  v  be 
the  head  of  x,  and  let  xs  be  the  tail  of  x]  first  compute  w,  then  increment  r 
and  then  call  sigma(xs,r )  to  sum  the  remainder  of  the  list. 

Program  tote ,  given  next,  is  analogous  to  total  of  the  previous  subsection. 

tote(x ,  z) 
int  r; 

{;  r  :=  0,  sigma(x,r),  z  =  rj 

A  version  using  parallel  composition  is  given  next. 

totpar(x ,  z) 
int  w ; 

{?  x?=  [] 

x  ?=  [u|a:s] 


} 


— >  z  —  0, 

~>  (II  {;  y  =  w}, 

z  =  zs  +  y, 
totpar(xs , zs) 

} 


~>  {;  f(v,w),  r:=r  +  w,  sigma(xs,r)} 
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This  program  spawns  programs  f(v,w ),  for  each  element  v  of  list  x,  in 
parallel.  Thus  if  /  takes  a  long  time  to  execute,  and  a;  is  a  large  list,  and  there 
are  a  large  number  of  processors,  the  parallel  version  will  execute  faster  than 
the  sequential  version,  because  execution  of  /  for  different  elements  of  the  list 
will  proceed  in  parallel. 

In  program  totpar  we  are  obliged  to  ensure  that  no  mutable  shared  variable 
in  a  parallel  composition  block  is  modified.  There  are  no  mutable  shared  vari¬ 
ables  in  the  parallel  composition  block,  and  hence  the  restriction  is  satisfied. 

Consider  an  erroneous  program  in  which  the  parallel  composition  block  of 
totpar  is  replaced: 

err  or -totpar  (x,  z) 
int  w ; 

{?  *?=  []  -> 

x  ?—  [u|a:s]  — > 


} 

In  this  program,  w  is  a  mutable  shared  by  blocks  f(v,  w)  and  z  =  zs  +  w 
in  a  parallel  composition  block,  and  w  is  modified  by  f(v,w );  this  violates 
the  restriction  on  shared  mutables  in  parallel  composition.  The  reason  for  the 
restriction  is  that  program  error  Jotpar(x,  z)  does  not  specify  what  value  of  w 
is  to  be  used  in  the  definition  z  =  zs  -f-  w.  is  it  the  value  of  w  before,  during  or 
after  the  execution  of  f(v,w )?  This  problem  does  not  arise  in  totpar  because 
the  shared  definition  variable  y  is  used  in  place  of  shared  mutable  w ,  and  y  is 
defined  as  the  correct  value  of  w  — —  the  value  of  w  after  f  (v,  w)  is  executed  — 
by  means  of  the  sequential  composition  block  {;  f(v,w ),  y  =  w}. 

17.4  Reverse  a  List 

Develop  a  program  rev  with  arguments  x,  e  and  6,  where  x  and  e  are  lists  that 
are  to  be  left  unchanged  by  rev,  and  b  is  to  be  defined  by  rev  to  be  the  list 
of  elements  in  x,  in  reverse  order,  concatenated  with  e.  For  example,  if  x  = 
["A"," B"],  and  e  =  ["(7","Z>"],  then  b  is  to  be  defined  as  ["B","A""C" 


z  =  0, 

{II  f(v,w), 
z  =  zs  +  w, 
error -totpar  (xs,  zs) 
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(The  name  b  stands  for  the  beginning  of  the  reversed  list,  and  e  stands  for  the 
end  of  the  reversed  list.) 


[]  ->  b=  e, 

[n  |  xs]  — >  {||  es  —  [n  |  e],  rev(xs,es,b)} 


Operation  of  the  Program 

1.  If  a;  is  the  empty  list,  then  b  =  e. 

2.  If  x  is  nonempty,  let  v  be  the  head  of  x  and  let  xs  be  the  tail  of  x.  Define 

b  by  rev(xs,  es,  b),  where  es  is  defined  as  v  followed  by  e.  For  example, 
if  *  =  and  e  =  ["C", "£>"],  then  v  is  "A",  and  zs  is  ["£"]’ 

Hence,  es  is  [" A ",  "C",  "D"]. 

Reasoning  About  the  Program  We  first  ensure  that  mutable  shared  vari¬ 
ables  are  not  modified  in  parallel  composition,  and  then  reason  about  the  pro¬ 
gram  by  induction  on  the  length  of  x.  This  reasoning  is  very  similar  to  that 
given  for  the  previous  programs,  and  is  left  to  the  reader. 

17.5  Height  Of  A  Binary  Tree 

Develop  a  program  ht  with  arguments  t  and  z,  where  t  is  a  binary  tree,  and 
z  is  to  be  defined  to  be  the  height  of  the  tree.  A  tree  t  is  either  the  empty 
tuple,  {  },  or  a  3-tuple  {left,val,  right},  where  left  and  right  are  the  left  and 
right  subtrees  of  t.  Both  t  and  z  are  definition  variables,  and  t  is  to  be  left 
unchanged  by  the  program. 

ht(t,  z ) 

{?<?={}  ->  *  =  0, 

t  ?=  {left, val, right)  ->  {||  ht(left,l),ht(right,r), 

{?  I  >=  r  — >  z  =  1  +  /, 
r  >=  l  ->  z  =  1  +  r 

} 


rev(x,  e,  b) 
{?  x  ?= 
x  ?= 

} 
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} 


} 


Operation  of  the  Program 

1.  If  ^  is  the  empty  tuple,  in  which  case  t  is  the  empty  tree,  its  height  z  is 
defined  to  be  0. 

2.  If  t  is  not  the  empty  tree,  then  t  is  a  3-tuple.  Let  t  be  the  tuple 
{left,  val,  right}.  Define  definition  variables  /  and  r  by  ht{left,  l)  and 
ht(right,  r ),  respectively.  If  /  exceeds  r  then  define  2  as  the  expression 
1  +  /.  If  r  exceeds  l  then  define  z  as  the  expression  1  +  r.  If  r  —  l,  then 
define  z  either  as  1  +  l  or  1  +  r. 

Reasoning  About  the  Program  We  check  that  mutable  shared  variables 
are  not  modified  in  parallel  composition.  We  reason  about  the  program  by 
induction  on  the  height  of  tree  t. 

Base  Case:  If  t  is  the  empty  tree,  then  its  height  z  is  defined  (correctly) 
as  0. 

Induction  Step:  Assume  that  the  program  is  correct  for  all  trees  t  with 
height  at  most  k  for  some  k  >  0,  and  prove  that  the  program  is  correct  for  all 
trees  with  height  k- f  1.  If  t  is  a  tree  with  height  k  +  1,  then  t  is  a  tuple  of  the 
form  {left, val, right)  where  the  heights  of  trees  left  and  right  are  at  most 
k.  By  the  induction  assumption,  ht(left,  l)  and  htfright,  r)  correctly  define  / 
and  r  to  be  the  heights  of  the  left  and  right  subtrees  of  t.  Hence  z  is  1  more 
than  the  height  of  the  higher  subtree. 

17.6  Preorder  Traversal  of  a  Binary  Tree 

Develop  a  program  preorder  with  arguments  t,  h  and  e,  where  t  is  a  binary 
tree,  b  and  e  are  lists.  Binary  trees  are  represented  using  tuples  as  in  the  last 
example.  Parameters  t  and  e  are  to  be  left  unchanged  by  the  program.  List 
b  is  to  be  the  list  consisting  of  the  val  of  all  nodes  of  the  tree  in  preorder, 
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concatenated  with  list  e.  (A  traversal  of  a  tree  in  preorder  visits  the  root, 
then  the  left  subtree,  and  finally  the  right  subtree.) 

preorder{t,  b,  e ) 

{?  *  ?=  {} 

t  ?=  {left, val, right} 


} 


Operation  of  the  Program 

1.  If  t  is  the  empty  tree  then  b  is  defined  as  e. 

2.  If  t  is  not  empty,  then  it  is  a  tuple  of  the  form  {left,  val,  right}.  In 
parallel,  define  m  by  preorder  {right,  m,  e),  and  /  by  preorder  {left,  l,  m), 
and  b  as  val  followed  by  l. 

Heasonmg  About  the  Program  First  check  that  shared  mutables  are  not 
modified  in  parallel  composition. 

We  prove  correctness  of  the  program  by  induction  on  the  height  of  tree  t. 

Base  Case:  If  t  is  the  empty  tree,  then  b  =  e,  because  there  are  no 

nodes  to  traverse. 


Induction  Step:  Assume  that  preorder{t,  b,  e)  is  correct  for  trees  of 

height  at  most  k,  k  >  0,  and  show  that  it  is  also  correct  for  trees  of  height 
k  +  1.  Let  t  be  a  tree  of  height  k  +  1.  Then  t  =  {left,  val, right},  where 
left  and  right  are  trees  of  height  at  most  k.  Define  a  definition  variable  m  by 
preorder{right,m,e).  By  the  induction  assumption,  m  is  the  preorder  traver¬ 
sal  of  the  right  subtree  concatenated  with  e.  Define  a  definition  variable  /  by 
Preorder{left,l,m).  By  the  induction  assumption,  l  is  the  preorder  traversal 
of  the  left  subtree  concatenated  with  m.  Define  b  as  [val  |  /];  hence,  b  is  val 


— >  b  =  e, 

->  {||  b  =  [val  |  /], 

preorder{left,  l,m ), 
preorder  {right,  m,  e) 
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followed  by  the  preorder  traversal  of  the  left  subtree  of  t  followed  by  the  pre¬ 
order  traversal  of  the  right  subtree  of  t,  and  hence  b  is  the  preorder  traversal 
of  t. 

17.7  Quicksort  with  Copying 

In  this  section  we  present  C.A.R.Hoare’s  quicksort  [9]  program,  ^0,  that  uses 
lists  (of  definition  variables);  later,  we  discuss  an  in  place  quicksort,  q\,  that 
uses  arrays.  (The  quicksort  algorithm  is  discussed  in  most  texts  on  algorithms 
such  as  [1].) 

In  this  section,  when  we  refer  to  a  list  of  numbers  we  mean  a  list  of  definition 
variables  that  (eventually)  reduce  to  numbers.  Program  gO  has  two  input 
variables,  x  and  end,  and  one  output  variable,  z:  variables  x  and  end  are 
definition  variables  that  are  not  defined  by  the  program,  and  z  is  a  definition 
variable  that  is  defined  by  the  program.  All  three  variables  are  lists  of  numbers. 
The  output  z  is  specified  to  be  the  list  x  sorted  in  increasing  order  concatenated 
with  list  end.  For  example  if  end  =  [5, 4]  and  x  =  [2, 1],  then  z  =  [1, 2, 5, 4],  If 
end  is  the  empty  list,  then  z  is  x  sorted  in  increasing  order. 

#0(;r,  end,z ) 

{?  x  ?=  [  ] 

x  ?=  [mid  |  as] 


} 

Operation  of  the  Program  The  operation  of  program  90  is  as  follows.  If 
x  is  the  empty  list  then  z  is  defined  to  be  end.  If  x  is  nonempty,  let  mid  be 
the  first  element  of  x,  and  let  xs  be  the  remaining  elements  of  x.  The  call 
partirnid,  xs,  left,  right )  defines  left  to  be  the  list  of  values  of  xs  that  are 
at  most  mid,  and  right  to  be  the  list  of  values  of  xs  that  exceed  mid.  Call 
qO(right,  end,  r),  thus  defining  r  to  be  the  sorted  list  of  right  appended  to  end. 
Call  qO(left,  [mid  \  r],z),  thus  defining  z  to  be  the  sorted  list  of  left  followed 
by  mid  followed  by  r. 


— >  z  =  end, 

->  {||  part(mid,xs,  left,  right), 
qO(left,  [mid  \  r\,z), 
qO(right,  end,  r) 

} 
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Reasoning  About  the  Program  There  are  no  shared  mutables  in  the 
parallel  composition,  and  hence  the  restrictions  on  parallel  composition  are 
satisfied.  We  reason  about  this  program  by  induction  on  the  length  of  x.  The 
reasoning  is  straightforward  and  is  left  to  the  reader. 

Next,  we  discuss  program  part.  Program  part  inspects  each  element  of  xs 
in  turn,  placing  elements  that  are  at  most  mid  in  left  and  all  other  elements 
in  right. 

part(mid,  xs,  left,  right ) 

{?  ^  ?=  []  ->  {||  left  =  [l  right  —  [  ]}, 

xs  ?=  [hd  |  tl\,  hd  <=  mid->  {||  left  =  [hd  |  /s], 

part(mid,  tl,  Is,  right ) 

xs  ?—  [hd  1 1/],  hd  >  mid  — >  {||  right  =  [hd  |  rs], 

partfmid,  tl,  left,  rs) 


Operation  of  the  Program  If  xs  is  the  empty  list,  define  left  and  right 
to  be  empty  lists.  If  xs  is  not  empty,  then  let  hd  and  tl  be  the  head  and  tail  (re- 


xs  is  nonempty;  let  hd  and  tl  be  the  head  and  tail  (respectively)  of  xs.  The 
length  of  tl  is  k.  Next,  consider  the  case  where  hd  is  at  most  mid.  From  the 
induction  assumption,  part(mid,  tl,  Is,  right )  defines  Is  and  right  to  be  the 
elements  of  tl  that  are  at  most  mid,  and  that  exceed  mid,  respectively.  Since, 
xs  is  hd  followed  by  tl,  and  hd  <  mid,  it  follows  that  the  sequence  of  elements 
of  xs  that  are  at  most  mid  is  hd  followed  by  the  sequence  of  elements  of  tl  that 
are  at  most  mid,  and  the  sequence  of  elements  of  xs  that  exceed  mid  is  the 
sequence  of  elements  of  tl  that  exceed  mid.  Hence,  in  this  case,  the  definitions 
of  left  and  right  are  correct.  A  similar  argument  applies  for  the  case  where 
hd  >  mid. 

17.8  In  Place  Quicksort 

Program  ql  Program  ql  has  two  input  parameters,  l,  and  r,  both  of  which 
are  definition  variables,  and  it  has  one  input-output  parameter  C  which  is  a 
one-dimensional  array  of  numbers.  Let  Cinit  be  the  initial  value  of  C,  and  let 
(j final  be  tte  value  q£  q  Qn  termination  of  the  program.  Then  Cfinal  is  to  be  a 
permutation  of  Cinit,  where  C'^nal[l, . . . ,  r]  is  Cinit[l, . . . ,  r]  in  increasing  order, 
and  the  other  elements  of  C  are  to  remain  unchanged.  (If  l  >  r  then  Cfinal  is 

(Jinit  ^ 

int  C[  ]; 

{?  /  <  r  — >  {;  split{l,  r,  C,  mid), 

{||  ?1(/,  mid-  1,(7),  ql(mid+  l,r,  C)} 

} 

Execution  of  split (l,  r,  C,  mid )  permutes  C  and  assigns  a  value  to  mid  such 
that  l  <  mid  <  r,  and  such  that  all  elements  in  C[l, . . . ,  mid  —  1]  are  at  most 
C[mid],  and  all  elements  in  C[mid  +  1, . . . ,  r]  exceed  C[mid]. 

Operation  of  the  Program  If  l  >  r,  then  ql  takes  no  action,  leaving  C 
unchanged.  If  l  <  r,  then  split  is  called,  and  after  split  terminates  execution, 
C[l, . . . ,  mid  —  1]  and  C[mid  +  1, . . . ,  r]  are  sorted  in  parallel. 
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Reasoning  About  the  Program  First  check  that  shared  mutables  in  par¬ 
allel  composition  are  not  modified.  Array  C  is  shared  by  ql(l,  mid-l,C )  and 
ql(mid  +  1  ,r,C),  but  no  element  of  C  is  shared  by  both  blocks.  Hence  the 
restriction  on  parallel  composition  is  satisfied. 

We  reason  about  the  program  by  induction  onr-l. 

Base  Case:  If  r  —  l  <  0,  then  C  is  left  unchanged,  and  this  is  correct 
according  to  our  specifications. 

Induction  Step:  Assume  that  ql(l,  r,  C)  is  correct  for  all  /,  r,  and  C 
for  which  r  /  5;  k-s  f°r  some  k  >  0,  and  prove  that  the  program  is  correct 
for  r  —  l  =  k  +  1.  Ifr  —  /  =  fc  +  l  then  l  <  r.  In  this  case  split  is  called, 
and  execution  of  split (l,  r,C,  mid)  permutes  C  and  assigns  a  value  to  mid 
such  that  l  <  mid  <  r,  and  such  that  all  elements  in  C\L _ mid  -  11  axe 


and  all  elements  in  C[l  +  1,...,  right]  are  at  most  s,  and  all  elements  in 
C[right  +  1, . . .  ,  r]  exceed  s. 

After  termination  of  parti,  program  swap  is  called  to  exchange  C[l\  (which 
is  s)  with  C [right].  After  the  swap,  all  elements  in  C[l, . . . ,  right  —  1]  are  at 
most  s,  and  C [right]  =  s,  and  all  elements  in  C[right  +  l, . . . ,  r]  exceed  s.  The 
program  terminates  after  mid  is  defined  as  right. 

Program  parti  Program  parti  moves  left  rightwards  and  moves  right  left¬ 
wards  until  they  cross  (i.e.,  left  =  right  +  1),  so  that  the  following  invariant 
is  maintained: 


invariant: 

/  +  1  <  left  <  r  +  1  and  /  <  right  <  r,  and 

all  elements  of  C[l  +  1, . . . ,  left  -  1]  are  at  most  s, 

and  all  elements  of  C [right  +  1, . . . ,  r]  exceed  s. 

From  the  invariant  it  follows  that  left  <  right  +  1. 

partial,  r,  G,  s,  left,  right) 
int  C[  ],  left,  right; 

{?  left  <=  right  —>  {; 

{ ||  leftjrightwardsfr,  C,  s,  left), 
right  Jeftwards(l  +  1,  C,  s,  right) 

}, 

left  <=  right  — >  {;  swapife ft, right, C), 

left  \=  left  +  l, 
right  :=  right  —  1 

}, 

partial,  r,  C,  s,  left,  right) 

} 

} 

leftjrightwards(r,  C,  s,  left) 
int  C[],  left; 

{?  left  <—  r,  C[left]  <=  s  — > 


67 


} 


{;  left  :=  left  +  1,  left  jrightwards{r,C,  s, left)} 


right  Jeftwards(l,  C ,  s,  right ) 
int  C[],  right ; 

{?  right  >=  l,  C[right]  >  s  —> 

{;  right  :=  right  —  1,  right  Jeftwards(l,C,s,  right)} 

swap(i,j,C ) 
int  i,  j,  C[  ],  temp-, 

{;  temp  :=  C[i],  C[i ]  :=  C\j],  C\j]  :=  temp} 

Operation  of  the  Program  The  invariant  holds  initially  because  left  = 
l  +  1  and  right  =  r.  Programs  leftjrightwards(r ,  C,  s,  left)  and 
right  Jeftwards(l  +  1,  C,  s,  right )  are  executed  in  parallel.  The  only  mutables 
that  change  value  in  these  programs  are  left  and  right,  and  these  mutables 
are  not  shared.  Therefore,  the  restriction  on  parallel  composition  is  satisfied. 

Program  leftjrightwards(r,C,s,left)  moves  left  rightwards  from  l  +  1, 
i.e.,  it  increases  left,  until  left  =  r  +  1  or  C[left]  >  s ,  and  it  maintains  the 
invariant.  Likewise,  right Jeftwards(l  +  1  ,G,s, right)  moves  right  leftwards 
from  r,  i.e.,  it  decreases  right,  until  right  =  l  or  C\right ]  <  s ,  and  it  maintains 
the  invariant.  If  left  =  r  +  1  or  right  =  l  then  left  >  right,  and  the  program 
terminates  execution.  Consider  the  case  where  C[right\  <  s  <  C[left\,  and 
left  <  right  at  termination  of  the  parallel  composition  block.  In  this  case, 
C[left\  and  C [right]  are  exchanged,  and  then  left  is  incremented  and  right 
is  decremented,  maintaining  the  invariant.  Then  parti  is  calls  itself. 

Reasoning  About  the  Program  We  reason  about  the  program  by  induc¬ 
tion  on  right  +  1  —  left. 

Base  Case:  Consider  the  case  where  right  +  1  -  left  =  0.  In  this 

case  the  program  terminates.  If  the  invariant  holds,  the  program  terminates 
correctly.  (The  program  may  not  terminate  correctly  if  the  invariant  does  not 
hold.) 
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Induction  Step:  Assume  that  the  program  is  correct,  for  all  parameters 
provided  right+l—left  <  k,  for  some  k  >  0,  provided  the  invariant  holds  when 
the  program  is  initiated,  and  prove  the  program  correct  for  right  +  1  —  left  = 
&  +  1  provided  the  invariant  holds  when  the  program  is  initiated. 

If  right  +  1  —  left  =  k  +  1  then  left  <  right.  In  this  case  the  parallel 
composition  of  right  -leftwards  and  leftjrightwards  maintains  the  invariant 
and  decreases  right  +  1  -  left,  or  it  leaves  left  and  right  unchanged.  In  the 
latter  case,  C[right]  <  s  <  C[left],  and  therefore,  C[left]  and  C[right]  are 
exchanged,  and  then  left  is  incremented  and  right  is  decremented,  maintaining 
the  invariant,  and  reducing  right  +  1  -  left.  Therefore,  when  parti  is  called 
recursively,  the  invariant  is  maintained,  and  right  +  1  -  left  <  k.  From  the 
induction  assumption,  the  recursive  call  to  parti  terminates  execution  with 
the  correct  values  for  C,  left  and  right. 


69 


18  Instructions  About  Where  to  Execute  Pro¬ 
grams 

For  purposes  of  efficiency,  programmers  may  want  to  specify  the  processors 
on  which  programs  are  to  be  executed.  For  this  purpose  the  annotation 
is  added  as  a  suffix  to  the  program  call  [6].  Specifying  processors  does  not 
change  the  semantics  of  programs. 

The  syntax  of  an  annotated  program  call  is: 


program-call  ::  program-call@location 

location  ::  variable  \  integer  |  relative-location 


A  PCN  program  runs  on  a  computer  in  which  processors  are  numbered  0  . . .  n, 
where  0  is  the  host  machine.  A  program  p  can  be  executed  on  a  processor 
numbered  i,  for  any  integer  i  where  0  <  *  <  n  by  executing  p@i  or  p@v,  where 
v  is  a  variable  with  reduced  value  i. 

PCN  can  execute  on  a  network  of  processors  where  the  topology  of  the 
network  can  take  any  form:  It  can  be  a  local  area  network  connecting  work¬ 
stations,  or  a  hypercube,  or  a  mesh,  to  name  a  few  examples.  Programmers 
find  it  convenient  to  develop  their  programs  for  a  given  topology,  and  to  have 
their  topology  mapped  to  that  of  the  machine  on  which  their  programs  execute 

[e]. 

The  processor  in  the  virtual  network  at  which  a  program  is  to  be  executed 
can  be  specified  by  appending  <3 relative-location  to  the  program  call.  For  ex¬ 
ample,  on  a  ring: 

relative-location  can  be  fwd  for  forward,  bwd  for  backward,  or  random; 

The  relative-location  specifies  a  processor  in  the  virtual  network  by  spec¬ 
ifying  its  relationship  (forward,  backward,  or  random)  with  respect  to  the 


70 


processor  executing  the  parallel  composition  block.  For  instance,  execution  of 
a  parallel  composition  statement  {||  p(left)@bwd,p(righi)@fwd}  in  a  pro¬ 
cessor  q  in  a  virtual  ring  would  cause  p(left)  and  p(right)  to  be  executed  on 
the  processor  following  q  and  preceding  q,  respectively,  on  the  virtual  ring. 

The  location  at  which  a  program  p(. . .)  is  to  be  executed  can  be  specified 
at  run-time  by  executing  the  statement  p{. .  where  a;  is  a  definition  vari¬ 
able.  Execution  of  p(. .  is  as  follows: 


repeat  skip  until  x  is  reducible; 

execute  p@loc  where  "loc"  is  the  reduced  value  of  x. 


For  instance,  if  the  reduced  value  of  x  is  "fwd",  then  p(. .  .)&x  is  executed  as 
p(. .  .)@fwd. 

If  a  program  call  is  executed  in  an  address  space  then  the  called  program 
will  not  be  executed  in  another  address  space  if  any  argument  of  the  called 
program  is  a  mutable. 
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19  Compilation  and  Modules 

Collections  of  related  PCN  programs  are  written  in  files,  for  convenience.  All 
PCN  programs  can  be  put  in  a  single  file,  but  it  is  usually  more  convenient 
to  partition  programs  in  some  logical  manner,  and  put  each  set  of  related 
programs  in  a  separate  file  [6].  A  file  containing  PCN  programs  is  called  a 
module,  and  the  name  of  the  file  is  also  the  module  name.  The  syntax  of  a 
module  is: 


module ::  -export  s(-<  program-name  M1)) 
-foreign(-«;  library-name  >-W) 

-<  program  >- 


where  program-name  is  the  name  of  one  of  the  programs  in  the  module, 
and  library-name  is  the  name  of  a  library  containing  C  object  code,  and  all 
names  are  quoted. 

An  example  of  a  module  is: 


-exports ( "member" ,  "sum") 

-foreign ("algebra. a" ,  "diff eqns . o") 

....  definition  of  programs  including  member  and  sum  ... 


If  there  is  no  export  statement  in  a  module  then  all  programs  are  exported. 
A  program  p  within  a  module  m  can  be  called  by  programs  in  other  modules 
if  and  only  if  p  is  exported  by  m.  A  program  in  a  module  references  a  PCN 
program  in  another  module  by  prefixing  the  name  of  the  referenced  program 
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with  the  name  of  the  module  in  which  the  referenced  program  is  located, 
followed  by  the  symbol  For  instance,  a  program  in  a  module  B  references 
a  program  p  in  another  module  D  as  D:p.  A  program  references  another 
program  in  the  same  module  without  the  ‘ module-name prefix. 

PCN  programs  can  also  call  C  and  Fortran  programs.  Consider  a  PCN 
program  p  that  calls  a  C  program  /  that  appears  in  a  library  L.  The  module 
in  which  p  appears  must  have  library  L  declared  as  foreign,  by  including  L  in 
the  -foreign^  library-name  statement  that  appears  in  the  module. 

A  PCN  source  file  can  begin  with  macro  definitions  and  file  inclusion  state¬ 
ments  as  in  C. 
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A  Complete  PCN  Syntax 

Non-terminal  symbols  begin  with  an  uppercase  letter.  Token  classes  such  as 
an  integer,  identifier  (ID),  or  string  are  signified  in  uppercase  and  are  lexically 
identical  to  C.  All  other  symbols  are  terminal. 


ModulePart  ::  Form  |  ModulePart  Form 
Form  ::  Program  |  Directive 

Directive  ::  -exports  Args  |  -capabilities  Args  |  -foreign  Args 


Program 

Heading 

Names 

NameList 


Heading  Declarations 
ID  Names 
(  )  |  (  NameList  ) 

ID  NameList  ,  ID 


Implication 


Declarations  ::  empty  |  Declarations  Declaration 
Declaration  ::  Type  Mutables  ; 

Mutables  ::  Mutable  |  Mutables  ,  Mutable 
Mutable  ::  ID  |  ID  Dimension 
Dimension  ::  [  ]  |  [  INTEGER  ]  |  [  Var  ] 


Implication 

Block 

Blocks 

Def 

Op 

Guard 

Tests 

Test 

Con 

Rhs 

Eq 

Ar 

Type 


::  Block  |  Guard  — >  Block 

::  Var  :=  Exp  |  Var  =  Def  |  ID  |  Call  |  {  Op  Blocks  } 

::  Implication  |  Blocks  ,  Implication 
::  Exp  |  Tuple  |  List  |  STRING  |  Call 

=:  I  I  I  ?  I  ; 

::  Tests  |  default 
::  Test  |  Tests  ,  Test 

::  ID  ?=  Rhs  |  Con  Eq  Con  |  Exp  Ar  Exp  |  Type  (  Def  )  I  data  (  Def  ) 
::  Exp  |  STRING  |  [  ]  |  {  } 

::  List  |  Tuple  |  Call 

::<!>!<=  I  >= 

::  int  |  double  |  char  |  tuple 
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Can 

LocalCall 

QID 

RemoteCall 

Args 

ArgList 

Exp 

Term 

Factor 

Num 

Numeric 

Var 

Subscript 

List 

Tuple 

Elements 

Element 


::  LocalCall  |  RemoteCall 
::  QID  :  QID  Args  |  QID  Args 
::  ID  |  ’  ID 

::  LocalCall  @  INTEGER  |  LocalCall  @  QID 
::  (  )  |  (  ArgList  ) 

::  Def  |  ArgList  ,  Def 

:  Term  |  Exp  +  Term  |  Exp  -  Term 
:  Factor  |  Term  *  Factor  |  Term  Factor  |  Term  %  Factor 
:  Num  |  (  Exp  )  |  length  (  ID  ) 

:  Numeric  |  —  Numeric  |  Var 
:  INTEGER  |  REAL 
:  ID  |  ID  Subscript 
:  [  INTEGER  ]  |  [  Var  ] 

[  ]  |  [  Elements  ]  |  [  Elements  |  Element  ] 

{  Elements  }  |  {  } 

Element  |  Elements  ,  Element 
Num  |  STRING  |  List  |  Tuple  |  Call 
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